local-mcp 3.0.113 → 3.0.115

package/download.js

@@ -439,4 +439,50 @@ async function ensureHelper() {
   }
 }
 
-module.exports = { ensureBinary, ensureRuntime, ensureTray, ensureTeamsProxy, ensureSlackProxy, ensureHelper, CACHE_DIR, TRAY_DIR }
+/**
+ * Downloads local-mcp-jxa-runner on first install only.
+ * CRITICAL: never replaces an existing jxa-runner binary — the runner owns
+ * Automation (JXA) TCC grants for Mail, Messages, Safari, etc. via its cdhash.
+ * Replacing the binary silently resets those grants and users would have to
+ * re-authorize in System Settings → Privacy & Security → Automation.
+ * @returns {Promise<string|null>} Path to the binary, or null if it fails
+ */
+async function ensureJXARunner() {
+  const binPath = path.join(CACHE_DIR, 'local-mcp-jxa-runner')
+
+  // Already installed — never replace. Stable cdhash = stable TCC grants.
+  if (fs.existsSync(binPath)) return binPath
+
+  const info = await getLatestBinary()
+  const version = info.version
+  const arch = process.arch === 'arm64' ? 'darwin-arm64' : 'darwin-x64'
+  const url = `https://download.local-mcp.com/local-mcp-jxa-runner-${version}-${arch}.tar.gz`
+  process.stderr.write(`\nDownloading local-mcp-jxa-runner v${version}...\n`)
+
+  fs.mkdirSync(CACHE_DIR, { recursive: true })
+  const tarPath = path.join(CACHE_DIR, `local-mcp-jxa-runner-${version}.tar.gz`)
+
+  try {
+    await downloadFile(url, tarPath)
+    const stat = fs.statSync(tarPath)
+    if (stat.size < 1000) { fs.unlinkSync(tarPath); throw new Error(`Incomplete download (${stat.size} bytes)`) }
+
+    execFileSync('tar', ['-xzf', tarPath, '-C', CACHE_DIR], { stdio: 'pipe' })
+    fs.unlinkSync(tarPath)
+
+    if (!fs.existsSync(binPath)) throw new Error('local-mcp-jxa-runner not found after extraction')
+    fs.chmodSync(binPath, 0o755)
+    // Do NOT codesign: the pre-built binary's cdhash must remain exactly as
+    // distributed so the Automation TCC entry stays valid permanently.
+
+    fs.writeFileSync(path.join(CACHE_DIR, '.jxa-runner-version'), version, 'utf8')
+    process.stderr.write(`  local-mcp-jxa-runner installed at ${binPath}\n`)
+    return binPath
+  } catch (err) {
+    try { if (fs.existsSync(tarPath)) fs.unlinkSync(tarPath) } catch {}
+    process.stderr.write(`  (local-mcp-jxa-runner not available: ${err.message})\n`)
+    return null
+  }
+}
+
+module.exports = { ensureBinary, ensureRuntime, ensureTray, ensureTeamsProxy, ensureSlackProxy, ensureHelper, ensureJXARunner, CACHE_DIR, TRAY_DIR }

package/index.js

@@ -17,39 +17,6 @@ const os    = require('os')
 const fs    = require('fs')
 const https = require('https')
 
-// Track first run / version change so analytics catch users who launch
-// via `npx local-mcp` without going through `setup` (manual MCP config).
-function _pingFirstRun(versionChanged) {
-  try {
-    const pkg = require('./package.json')
-    const machineId = (() => {
-      try {
-        const out = execSync("system_profiler SPHardwareDataType 2>/dev/null | awk '/Hardware UUID/ { print $3 }'", { encoding: 'utf8' }).trim()
-        return out || ''
-      } catch { return '' }
-    })()
-    const data = JSON.stringify({
-      version: pkg.version,
-      os_version: os.release(),
-      arch: process.arch,
-      node_version: process.version,
-      method: 'npx-default',
-      machine_id: machineId,
-      source: process.env.LMCP_SOURCE || '',
-      ref: process.env.LMCP_REF || '',
-    })
-    const req = https.request({
-      hostname: 'office-mcp-production.up.railway.app',
-      path: '/install/npm',
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Content-Length': data.length },
-      timeout: 5000,
-    })
-    req.on('error', () => {})
-    req.write(data)
-    req.end()
-  } catch { /* fire and forget */ }
-}
 
 // Solo macOS
 if (process.platform !== 'darwin') {
@@ -136,21 +103,59 @@ async function main() {
         : ''
       if (cachedVersion && semverGte(cachedVersion, pkg.version)) {
         // Cached binary is same or newer — use fast path, no download needed
-        const { ensureTray, ensureTeamsProxy, ensureHelper } = require('./download')
+        const { ensureTray, ensureTeamsProxy, ensureHelper, ensureJXARunner } = require('./download')
         ensureTray().catch(() => {})
         ensureTeamsProxy().catch(() => {})
         ensureHelper().catch(() => {})
+        ensureJXARunner().catch(() => {})
         const child = spawn(stableBin, [], { stdio: 'inherit', env: process.env })
         child.on('error', () => process.exit(1))
         child.on('exit', (code) => process.exit(code ?? 0))
+
+        // Background update check — fires 10s after startup, at most once per 24h.
+        // Covers machines where the tray is dead and Sparkle can't update the binary.
+        const lastCheckFile = path.join(CACHE_DIR, '.last-update-check')
+        function _needsUpdateCheck() {
+          try { return Date.now() - parseInt(fs.readFileSync(lastCheckFile, 'utf8').trim(), 10) > 86400000 } catch { return true }
+        }
+        if (_needsUpdateCheck()) {
+          try { fs.writeFileSync(lastCheckFile, String(Date.now())) } catch {}
+          const _cachedVersion = cachedVersion  // capture for closure
+          setTimeout(() => {
+            const req = https.get('https://office-mcp-production.up.railway.app/runtime/latest', { timeout: 8000 }, (res) => {
+              let buf = ''
+              res.on('data', c => buf += c)
+              res.on('end', () => {
+                try {
+                  const { version: latestVersion } = JSON.parse(buf)
+                  if (latestVersion && !semverGte(_cachedVersion, latestVersion)) {
+                    // New version available — download silently for next restart
+                    const { ensureRuntime } = require('./download')
+                    ensureRuntime().then(({ binPath, version: downloadedVersion }) => {
+                      try {
+                        const tmpPath = stableBin + '.tmp'
+                        fs.copyFileSync(binPath, tmpPath)
+                        fs.chmodSync(tmpPath, 0o755)
+                        try { execFileSync('codesign', ['--force', '--sign', '-', '--identifier', 'com.local-mcp.server', tmpPath], { stdio: 'pipe' }) } catch {}
+                        fs.renameSync(tmpPath, stableBin)
+                        fs.writeFileSync(versionFile, downloadedVersion || latestVersion)
+                      } catch {}
+                    }).catch(() => {})
+                  }
+                } catch {}
+              })
+            })
+            req.on('error', () => {})
+            req.on('timeout', () => { try { req.destroy() } catch {} })
+          }, 10000)
+        }
+
         return
       }
       // Cached binary is older than our npm package — download/update
       process.stderr.write(`Updating LMCP server (${cachedVersion || '?'} → ${pkg.version})...\n`)
-      _pingFirstRun(true)
     } else {
       // No cached binary version → first run via default mode
-      _pingFirstRun(false)
     }
     if (stat.isSymbolicLink()) fs.unlinkSync(stableBin)
   } catch {
@@ -158,12 +163,13 @@ async function main() {
   }
 
   // Slow path: download/repair binary
-  const { ensureRuntime, ensureTray, ensureTeamsProxy, ensureHelper } = require('./download')
+  const { ensureRuntime, ensureTray, ensureTeamsProxy, ensureHelper, ensureJXARunner } = require('./download')
 
-  // Update tray + proxies in background. Helper is downloaded only on first install.
+  // Update tray + proxies in background. Helper + jxa-runner downloaded only on first install.
   ensureTray().catch(() => {})
   ensureTeamsProxy().catch(() => {})
   ensureHelper().catch(() => {})
+  ensureJXARunner().catch(() => {})
 
   let runtime
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "local-mcp",
-  "version": "3.0.113",
+  "version": "3.0.115",
   "description": "LMCP — connect Claude Desktop, Cursor, Windsurf to Mail, Calendar, Contacts, Teams, OneDrive on macOS. Privacy-first: all data stays on your Mac.",
   "main": "index.js",
   "bin": {

package/setup.js

@@ -327,7 +327,9 @@ async function runSetup(opts = {}) {
     } catch { /* non-fatal */ }
   }
 
-  _pingInstall(configured, opts.method || 'setup', email)
+  // LMCP_METHOD lets install.sh pass 'curl' so we can distinguish it from
+  // a direct 'npx local-mcp setup' invocation in the analytics.
+  _pingInstall(configured, process.env.LMCP_METHOD || opts.method || 'npx-setup', email)
 }
 
 async function _installTeamsProxy() {
@@ -576,21 +578,6 @@ function _autoLaunchClient(configured) {
     return
   }
 
-  // Log auto-launch event (fire-and-forget)
-  try {
-    const https = require('https')
-    const data = JSON.stringify({ event: 'install_auto_launch', client: clientName })
-    const req = https.request({
-      hostname: BACKEND_HOST,
-      path: '/install-event',
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Content-Length': data.length },
-      timeout: 5000,
-    })
-    req.on('error', () => {})
-    req.write(data)
-    req.end()
-  } catch {}
 }
 
 module.exports = { runSetup, injectMcpConfig, CLIENTS }